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IN THE CLAIMS 

Amended claims follow: 

1 . (Currently Amended) A computer program produc t e mbodi e d on a tangible 
computor r e adabl e medium in a computer storage meditttn c omprising a computer 
program operable to control a computer to detect a known computer program within a 
packed computer file, said packed computer file being unpacked upon execution, said 
computer program comprising: 

resource data reading logic for reading resource data within said packed computer 
file, said resource data specifying program resource items xised by said known computer 
program and readable by a computer operating system without dependence upon which 
unpacking algorithm is used by said packed computer file; and 

resource data comparing logic for generating characteristics of said resource data 
and for comparing said characteristics of said resource data with characteristics of known 
computer program resource data and for detecting a match with said known computer 
program indicative of said packed computer file containing said knowfl computer 
program; 

wherein said resoxirce data of said packed computer file is processed to generate 
fingerprint data and to compare said generated fmgerptint data with known computer 
program fingerprint data; 

wherein said generated fingerprint data includes a number of program resource 
items specified within said resource dat a of said packed comnutcr file : 

wherein said generated fi ngerprint data includes a flag indicating which data is 
included within said generated fi ngerprint data; 

wherein said generated fingerprint data includes a location within said resource 
dat a of said packed computer file of an entry specifying a program resource item having a 
largest size^ 

wherein said generated fingerprint data includes a checksum value calculated in 
dependence upon: 
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a number of said program resource items specified beneath each node within 
hierarchically arranEcd resource data of said packed computer file; 

string names associated with said program resource items within said resource 
data of said packed computer file: and 

sizes of said program resource items ^vithin said resource data of said packed 
computer file . 

2. (Original) A computer program product as claimed in claim 1 , wherein said 
known computer program is one of: 

a Trojan computer program; and 
a worm computer program. 

3. (Currently Ajtnended) A computer program product as claimed in claim 1, 
wherein said resource dat a of said packed computer file comparing logic is operable to 
compare said resource data with characteristics of a plurality of known computer 
programs to detect if said packed computer program contains one of said plurality of 
known computer programs. 

4, (Cancelled) 

5, (Original) A computer progtam product as claimed in claim 1, wherein said 
program resotirce items used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 
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6. (Currently Amended) A computer program product as claimed in claim 1, 
wherein said resource dat a of said packed computer file specifies for each resource item a 
storage location of said resource item. 

7. (Original) A computer program product as claimed in claim 6, wherein said 
storage location of said resource item is specified as an relative offset value. 

8. (Currently Amended) A computer program product as claimed in claim 1, 
wherein said resource dat a of said tracked computer file specifies for each resource item a 
size of said resource item. 

9. (Cancelled) 

10. (Cancelled) 

11. (Cancelled) 

12. (Currently Amended) A computer program product as claimed in claim 1, 
wherein said generated fi ngerprint data includes timestamp data indicative of a time of 
compilation of said known computer program. 

13. (Cancelled) 

14. (Currently Amended) A computer program product as claimed in claim [[9]]1, 
wherein said checksum value is rotated between each item being added into said 
checksum. 

15. (Original) A computer program product as claimed in claim 1, wherein said 
packed computer file includes an unpacking computer program which upon execution 
decompresses said known computer program. 
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16. (Original) A computer program product as claimed in claim 1. wherein said 
packed computer file is a Win32 PE file, 

17. (Currently Amended) A computer program produc t embodie d 0B ^4angibI e 
Qomputor readabl e m e dium in a computer storage medium c omt>rising a computer 
program operable to control a computer to generate data for detecting a known computer 
program within a packed computer file, said packed computer file being unpacked upon 
execution, said computer program comprising: 

resource data reading logic for reading resource data within said packed computer 
file, said resource data specifying program resource items used by said known computer 
program and readable by a computer operating system without dependence upon which 
unpacking algorithm is used by said packed computer file; and 

characteristic data generating logic for generating characteristic data associated 
with said resource data for comparison with characteristic data of known computer 
program resoxjrce data to detect a match with said known computer program indicative of 
said packed computer file containing said known computer program; 

wherein said resource data of said packed computer file is processed to generate 
fingerprint data and to compare said generated fingerormt data with known computer 
program fingerprint data; 

wherein said generated fi ngerprint data includes a number of program resource 
items specified within said resource dat a of said packed computer file: 

wherein said generated fi ngerprint data includes a flag indicating which data is 
included within said generated fi ngerprint data; 

wherein said generated f ingerprint data includes a location within said resource 
dat a of said packed computer file of an entry specifying a program resource item having a 
largest size; 

wherein said generated fingerprint data includes a checksum value calculated in 
dependence unon: 

a number of program resource items specified beneath_each node within 
hierarchically arranged resource data of said packed computer file: 
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string names associated with pro-am Tesouroe items within said resource data of 
said packed computer file: and 

sizes of progTam resnurce items within said resource data of said packed c omputer 

file- 

18. (Original) A computer program product as claimed in claim 17, wherein said 
known computer program is one of: 

a Trojan computer program; and 
a worm computer program . 

19. (Previously Presented) A computer program product as claimed in claim 17, 
wherein said characteristic data generating logic is operable to generate characteristic 
data from a plurality of known computer programs to enable detection of any of said 
plurality of known computer programs within said packed computer program. 

20. (Cancelled) 

21 . (Original) A computer program product as claimed in claim 17, wherein said 
program resource items used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 

22. (Currently Amended) A computer program product as claimed in claim 17, 
wherein said resource dat a of said packed computer file specifies for each resource item a 
storage location of said resource item* 
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23. (Original) A computer program product as claimed in claim 22, wherein said 
storage location of said resource item is specified as an relative offset value. 

24. (Currently Amended) A computer program product as claimed in claim 17, 
wherein said resoxirce dat a of said packed computer file specifies for each resource item a 
size of said resource item. 

25. (Cancelled) 

26. (Cancelled) 

27. (Cancelled) 

28- (Currently Amended) A computer program product as claimed in claim 17, 
wherein said generated fingerprint data includes timestamp data indicative of a time of 
compilation of said known computer program, 

29. (Cancelled) 

30. (Currently Amended) A computer program product as claimed in claim 
[[25]]17, wherein said checksum value is rotated between each item being added into said 
checksum. 

3 1 . (Original) A computer program product as claimed in claim 17, wherein said 
packed computer file includes an unpacking computer program which upon execution 
decompresses said known computer program. 

32. (Original) A computer program product as claimed in claim 17, wherein said 
packed computer file is a Win32 PE file. 
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33 . (Currently Amended) A method of controlling a computer to detect a known 
computer program within a packed computer file, said packed computer file being 
unpacked upon execution, said method comprising the steps of: 

reading resource data within said packed computer file, said resource data 
specifying program resource items used by said known computer program and readable 
by a computer operating system without dependence upon which unpacking algorithm is 
used by said packed computer file; and 

generating characteristics of said resource data and comparing said characteristics 
of said resource data with characteristics of known computer program resource data and 
detecting a match with characteristics of said known computer program indicative of said 
packed computer file containing said known computer program; 

wherein said resource data of said packed computer file is processed to generate 
fingerprint data and to compare said generated fi tigerprint data with known computer 
program fingerprint data; 

wherein said generated fi ngerprint data includes a number of program resource 
items specified within said resource dat a of said packed computer file : 

wherein said generated fi ngerprint data includes a flag indicating which data is 
included within said generated fi ngerprint data; 

wherein said generated fi ngerprint data includes a location within said resource 
dat a of said packed computer file of an entry specifying a program resource item having a 
largest size; 

wherein said generated fingerprint data includes a checksum value calculated in 
dependence upon: 

a number of program resource items specified beneath each node within 
hierarclucallv arranged resource data of said packed computer file: 

string names associated with program resource items vyithin sai d resource data of 
said packed computer file; and 

sizes of program resource items within said resource data of said packed compute 

file. 
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34. (Oxiginal) A method as claimed in claim 33, wherein said known computer 
program is one of: 

a Trojan computer program; and 
a worm computer program, 

35. (Currently Amended) A method as claimed in claim 33, wherein said step of 
compariTig compares said resource dat a of said packed computer file with characteristics 
of a plurality of known computer programs to detect if said packed computer program 
contains one of said plurality of known computer programs, 

36- (Cancelled) 

37. (Original) A method as claimed in claim 33, wherein said program resource 
items used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 

38. (Currently Amended) A method as claimed in claim 33, wherein said resource 
dat a of said packed computer file specifies for each resource item a storage location of 
said resource item. 

39- (Original) A method as claimed in claim 38, wherein said storage location of 
said resource item is specified as an relative offset value. 

40. (Currently Amended) A method as claimed in claim 33, wherein said resource 
dat a of said packed computer file specifies for each resource item a size of said resource 
item. 
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41. (Cancelled) 

42. (Cancelled) 

43. (Cancelled) 

44. (Currently Amended) A method as claimed in claim 33j wherein said 
generated fingerprint data includes timestamp data indicative of a time of compilation of 
said known computer prograra, 

45. (Cancelled) 

46. (Currently Amended) A method as claimed in claim [[4l]]33, wherein said 
checksum value is rotated between each item being added into said checksum. 

47. (Original) A method as claimed in claim 33^ wherein said packed computer 
file includes an unpacking computer program which upon execution decompresses said 
known computer program. 

48. (Original) A method as claimed in claim 33, wherein said packed computer 
file is a Win32 PE file. 

49. (Currently Amended) A method of controlling a computer to generate data for 
detecting a known computer program within a packed computer file^ said packed 
computer file being unpacked upon execution, said method comprising the steps of: 

reading resource data within said packed computer file, said resource data 
specifying program resource items used by said known computer program and readable 
by a computer operating system without dependence upon which unpacking algorithm is 
used by said packed computer file; and 
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generating characteristic data associated with said resource data for comparison 
with characteristic data of Icnown computer program resource data and detecting a match 
with said known computer program indicative of said packed computer file contaimng 
said known computer program; 

wherein said resource data of said packed computer file is processed to generate 
fingerprint data and to compare said generated fi ngerprint data with known computer 
program fingerprint data; 

wherein said generated fi ngerprint data includes a number of program resource 
items specified within said resource dat a of said packed computer file : 

wherein said generated fmgerprint data includes a flag indicating which data is 
included within said generated fingerprint data; 

wherein said generated fingerprint data includes a location within said resource 
dat a of said packed computer file of an entry specifying a program resource item having a 
largest size; 

wherein said generated fingerprint data includes a checkstam value calculated in 
dependence upon: 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data of said packed computer file: 

string names associated with program resource items within said resource data of 
said packed computer file: and , 

sizes of program resource items within said resource data of said packed computer 

file. 

50. (Original) A method as claimed in claim 49, wherein said known computer 
program is one of: 

a Trojan computer program; and 
a worm computer program. 

51 . (Previously Presented) A method as claimed in claim 49, wherein said step of 
generating generates characteristic data from a plurality of known computer programs to 
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enable detection of any of said plurality of kiio>vn computer programs within said packed 
computer program. 

52. (Cancelled) 

53. (Original) A method as claimed in claim 49, wherein said program resource 
items used by said known computer program include one or more of: 

icon data; 
string data; 
dialog data; 
bitmap data; 
menu data; and 
language data. 

54. (Currently Amended) A method as claimed in claim 49, wherein said resource 
dat a of said packed computer file specifies for each resource item a storage location of 
said resource item. 

55. (Original) A method as claimed in claim 54, wherein said storage location of 
said resource item is specified as an relative offset value. 

56. (Currently Amended) A method as claimed in claim 49, wherein said resource 
dat a of said packed computer file specifies for each resource item a size of said resource 
item. 

57. (Cancelled) 

58. (Cancelled) 

59. (Cancelled) 
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60. (Currently Amended) A method as claimed in claim 49, wherein said 
generated fi ngerprint data includes timestamp data indicative of a time of compilation of 
said known computer program 

61. (Cancelled) 

62. (Currently Amended) A method as claimed in claim [[57]]49, wherein said 
checksum value is rotated between each item being added into said checksum, 

63. (Original) A method as claimed in claim 49, wherein said packed computer 
file includes an unpacking computer program which upon execution decompresses said 
known computer program. 

64. (Original) A method as claimed in claim 49, wherein said packed computer 
file is a Win32 PEfile. 

65. (Currently Amended) Apparatus for detecting a known computer program 
within a packed computer file, said packed computer file being unpacked upon execution, 
said apparatus comprising: 

a resource data reader for reading resource data within said packed computer file, 
said resource data specifying program resource items used by said known computer 
program and readable by a computer operating system without dependence upon which 
unpacking algorithm is used by said packed computer file; and 

a resource data comparator for generating characteristics of said resource data and 
for comparing said characteristics of said resource data with characteristics of known 
computer program resource data for detecting a match AJ^th said known computer 
program indicative of said packed computer file containing said known computer 
program; 

wherein said resource data of said packed computer file is processed to generate 
fingerprint data and to compare said generated fi ngerprint data with known computer 
program fingerprint data; 
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wherein said generated fi ngerprint data includes a number of program resource 
items specified within said resource dat a of said packed computer file : 

wherein said generated fi ngerprint data includes a flag indicating which data is 
included within said generated fi ngerprint data; 

wherein said generated fingerprint data includes a location within said resource 
dat a of said packed computer file of an entry specifying a program resource item having a 
largest size; 

wherein said generated fin ger print data includes a checksum value calculated in 
dependence upon: 

a number of program resource items specified beneath each node within 
hierarchically arranged resource data of said packed computer file: 

string names associated with program resource items within said resource data of 
said packed computer file: and 

sizes of program resource items within said resource data of said packed computer 

file^ 

66. (Original) Apparatus as claimed in claim 65, wherein said known computer 
program is one of: 

a Trojan computer program; and 
a worm computer program. 

67. (Currently Amended) Apparatus as claimed in claim 65, wherein said resource 
data comparator is operable to compare said resource dat a of said packed computer file 
with characteristics of a plurality of known computer programs to detect if said packed 
computer program contains one of said plurality of known computer programs. 

68. (Cancelled) 

69. (Original) Apparatus as claimed in claim 65, wherein said program resource 
items used by said known computer program include one or more of: 

icon data; 
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string data; 
dialog data; 
bitmap data; 
menu data; and 
language data, 

70. (Currently Amended) Apparatus as claimed in claim 65, wherein said resource 
dat a of said packed computer file specifies for each resource item a storage location of 
said resource item, 

71. (Original) Apparatus as claimed in claim 70, wherein said storage location of 
said resource item is specified as an relative offset value. 

72. (Currently Amended) Apparatus as claimed in claim 65, wherein said resource 
dat a of said packed computer file specifies for each resource item a size of said resource 
item. 

73. (Cancelled) 

74. (Cancelled) 

75. (Cancelled) 

76. (Currently Amended) Apparatus as claimed in claim 65, wherein said 
generated fingerprint data includes timestamp data indicative of a time of compilation of 
said known computer program. 

77. (Cancelled) 

78. (Currently Amended) Apparatus as claimed in claim [[73]]65, wherein said 
checksum value is rotated between each item being added into said checksum. 
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79. (Original) Apparatus as claimed in claim 65, wherein said packed computer 
file includes an unpacking computer program which upon execution decompresses said 
known computer program. 

80. (Original) Apparatus as claimed in claim 65, wherein said packed computer 
file is a Win32 PE file. 

81. (Currently Amended) Apparatus for generating data for detecting a known 
computer program within a packed computer file, said packed computer file being 
unpacked upon execution, said apparatus comprising: 

a resource data reader for reading resource data within said packed computer file, 
said resource data specifying program resource items used hy said known computer 
program and readable by a computer operating system wilhout dependence upon which 
unpacking algorithm is used by said packed computer file; and 

a characteristic data generator for generating characteristic data associated with 
said resource data for comparison with characteristic data of known computer program 
resource data and for detecting a match with said known computer program mdicative of 
said packed computer file containing said known computer program; 

wherein said resource data of said packed computer file is processed to generate 
fmgerprint data and to compare said generated fingerprint data with known computer 
program fmgerprint data; 

wherein said generated fingerprint data includes a number of program resource 
items specified within said resource da ta of said packed com puter file; 

wherein said generated fmgerprint data includes a flag indicating which data is 
included within said generated fi ngerprint data; 

wherein said generated fi ngerprint data includes a location within said resource 
dat a of said packed computer file of an entry specifying a program resoxirce item having a 
largest size; 

wherein said generated fingerprint data includes a check ^niiD value calculated in 
dependence upon: 



PAGE 19135 * RCVD AT 11/27/2006 7:03:26 PM [Eastern Standard Time] ' SVR:USPTO-EFXRF-6/34 * DNIS:2738300 * CSID:4089714660 * DURATION (min-ss):05-10 



NOV. 27. 2006 4:1 7PM ZILKA-KOTAB, PC 

-17- 



NO. 4914 P. 20 



a number of program resource items specified beneath each node within 
hierarchically arranged resource data of said packed computer file: 

string names associated with program resource items within said resource data of 
said packed computer file: and 

sizes of program resource items within said resource data of said packed computer 

file. 

82. (Original) Apparatus as claimed in claim 81, wherein said known computer 
program is one of: 

a Trojan computer program; and 
a worm computer program. 

83. (Previously Presented) Apparatus as claimed in claim 81 , wherein said 
characteristic data generator is operable to generate characteristic data from a pluiality of 
known computer programs to enable detection of any of said plurality of known 
computer programs within said packed computer program. 

84. (Cancelled) 

85. (Original) Apparatus as claimed in claim 81, wherein said program resource 
items used by said known computer program include one or more of; 

icon data; 
string data; 
dialog data; 
bitm^ data; 
menu data; and 
language data. 

86. (Currently Amended) Apparatus as claimed in claim 8 1 , wherein said resource 
dat a of said packed computer file specifies for each resource item a storage location of 
said resource item. 
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87. (Original) Apparatus as claimed in claim 86, wherein said storage location of 
said resource item is specified as an relative offset value. 

88. (Currently Amended) Apparatus as claimed in claim 81, wherein said resource 
dat a of said packed computer file specifies for each resource item a size of said resource 
item. 

89. (Cancelled) 

90. (Cancelled) 

91. (Cancelled) 

92. (Cxurently Amended) Apparatus as claimed in claim 81, wherein said 
generated fingerprint data includes timestamp data indicative of a time of compilation of 
said known computer program. 

93. (Cancelled) 

94. (Currently Amended) Apparatus as claimed in claim [[89]]8L wherein said 
checksum value is rotated between each item being added into said checksum. 

95- (Original) Apparatus as claimed in claim 81 , wherein said packed computer 
file includes an unpacking computer program which upon execution decompresses said 
known computer program. 

96. (Original) Apparatus as claimed in claim 8 1 , wherein said packed computer 
file is a Win32 PE file. 

97. (Cancelled) 
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98. (Previously Presented) A computer program product as claimed in claim 14, 
wherein said checksum value is rotated 1 bit to the left. 
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